''nss_params'' are themselves name/value pairs, parsed with the same rules
described above. Valid names inside nss_params are:
<dl><dd>:'''flags''' - comma separated list of flag values, parsed case-insensitive. <br>:Valid flag values are:<dl><dd>::'''internal''' - this library is actually the Netscape internal library<br>::'''fips''' - this library is the Netscape internal fips library.<br>::'''critical''' - if this library cannot be loaded, completely fail initialization.<br>::'''moduleDB''' - this library includes NSS specific functions to supply additional module specs for loading.::'''moduleDBOnly''' - this library has no PKCS #11 functions and is only used for loading additional modules.</dd></dl>:'''trustOrder''' - integer value specifying the order in which the trust information for certificates specified by tokens on this PKCS #11 library should be rolled up. '0' means that tokens on this library should not supply trust information (default). The relative order of two pkcs#11 libraries which have the same trustOrder value is undefined.<br>:'''cipherOrder''' - integer value specifiying the order in which tokens are searched when looking for a token to do a generic operation (DES/Hashing, etc).<br>:'''ciphers''' - comma separated list of ciphers this token will enable that isn't already enabled by the library (currently only '''FORTEZZA''' is defined) (case-insensitive).<br>:'''slotParams''' - space separated list of name/value pairs where the name is a slotID and the value is a space sparated list of parameters related to that slotID.<br>:Valid slotParams values are:<dl><dd>::'''slotFlags''' - comma separated list of cipher groups which this slot is expected to be the default implementation for (case-insensitive).<br>::Valid flags are:<dl><dd>:::'''RSA''' - This token should be used for all RSA operations (other than Private key operations where the key lives in another token).<br>:::'''DSA''' - This token should be used for all DSA operations (other than Private key operations where the key lives in another token).<br>:::'''RC4''' - This token should be used for all RC4 operations which are not constrained by an existing key in another token.<br>:::'''RC2''' - This token should be used for all RC2 operations which are not constrained by an existing key in another token.<br>:::'''DES''' - This token should be used for all DES, DES2, and DES3 operations which are not constrained by an existing key in another token.<br>:::'''DH''' - This token should be used for all DH operations (other than Private key operations where the key lives in another token).<br>:::'''FORTEZZA'''- This token should be used for all KEA operations (other than Private key operations where the key lives in another token), as well as SKIPJACK operations which are not constrained by an existing key in another token.<br>:::'''RC5''' - This token should be used for all RC5 operations which are not constrained by an existing key in another token.<br>:::'''SHA1''' - - This token should be used for all basic SHA1 hashing.<br>:::'''MD5''' - This token should be used for all basic MD5 hashing.<br>:::'''MD2''' - This token should be used for all basic MD2 hashing.<br>:::'''SSL''' - This token should be used for SSL key derivation which are not constrained by an existing key in another token.<br>:::'''TLS''' - This token should be used for TLS key derivation which are not constrained by an existing key in another token.<br>:::'''AES''' - This token should be used for all AES operations which are not constrained by an existing key in another token.<br>:::'''RANDOM''' - This token should be used to generate random numbers when the application call 'PK11_GenerateRandom'.<br>:::'''PublicCerts''' - The certificates on this token can be read without authenticating to this token, and any user certs on this token have a patching public key which is also readable without authenticating. Setting this flags means NSS will not try to authenticate to the token when searching for Certificates. This removes spurious password prompts, but if incorrectly set it can also cause NSS to miss certificates in a token until that token is explicitly logged in.</dd></dl>::'''rootFlags''' - comma separated of flags describing any root certs that may be stored (case-insensitive).<br>::Valid flags are:<dl><dd>:::'''hasRootCerts''' - claims that this token has the default root certs and trust values. At init time NSS, will try to look for a default root cert device if one has not already been loaded.<br>:::'''hasRootTrust''' - parsed but ignored.<br>:::'''timeout''' - time in minutes before the current authentication should be rechecked. This value is only used if askpwd is set to 'timeout'. (default = 0).<br>:::'''askpwd''' - case-insensitive flag describing how password prompts should be manages. Only one of the following can be specified.<dl><dd>::::'''every''' - prompt whenever the a private key on this token needs to be access (this is on the entire token, not on a key-by-key basis.<br>::::'''timeout'''- whenever the last explicit login was longer than 'timeout' minutes ago.<br>::::'''only''' - authenticate to the token only when necessary (default).</dd></dl></dd></dl></dd></dl>
Sample file:
